VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.69

Vulnerabilities affecting this package (45)

Advisory	Summary	Fixed in package version
CVE-2019-17563	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a …	There are no reported fixed by versions.
CVE-2018-8034	The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions …	9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.30 Vulnerable 8.0.53 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable
CVE-2019-0221	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided …	9.0.19 Vulnerable 9.0.20 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 7.0.94 Vulnerable
CVE-2019-0232	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and …	9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
CVE-2018-1305	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …	9.0.6 Vulnerable 9.0.7 Vulnerable 9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.0.50 Vulnerable 8.0.51 Vulnerable 8.0.53 Vulnerable 8.5.28 Vulnerable 8.5.29 Vulnerable 8.5.30 Vulnerable 8.5.31 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.86 Vulnerable 7.0.88 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable
CVE-2018-11784	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …	9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable
CVE-2018-1336	An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …	9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.0.53 Vulnerable 8.5.31 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.88 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
GHSA-9xcj-c8cr-8c3c Aliases: CVE-2019-17563	In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation …	7.0.99 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	7.0.100 Vulnerable
GHSA-c9hw-wf7x-jp9j Aliases: CVE-2020-1938	Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …	7.0.100 Vulnerable
CVE-2019-12418 Aliases: GHSA-hh3j-x4mc-g48r	In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords …	9.0.29 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
CVE-2021-25329	Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was …	9.0.41 Vulnerable 7.0.107 Vulnerable 8.5.61 Vulnerable
CVE-2020-8022 Aliases: GHSA-gc58-v8h3-x2gr	A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, …	9.0.35 Vulnerable 8.0.53 Vulnerable
CVE-2016-6794	Information Exposure When a `SecurityManager` is configured, a web application's ability to read system properties should be controlled by the …	8.0.37 Vulnerable 8.5.5 Vulnerable 9.0.1 Vulnerable 7.0.72 Vulnerable
CVE-2017-5664	Improper Handling of Exceptional Conditions The error page mechanism of the Java Servlet Specification requires that, when an error occurs …	7.0.78 Vulnerable 8.0.44 Vulnerable 8.5.15 Vulnerable 9.0.1 Vulnerable 7.0.52 Vulnerable 8.0.8 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2017-5648	Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade …	9.0.1 Vulnerable 7.0.76 Vulnerable 8.0.42 Vulnerable 8.5.12 Vulnerable
CVE-2016-8745	Information Exposure A bug in the error handling of the NIO HTTP connector in Apache Tomcat resulted in the current …	7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable 9.0.1 Vulnerable
GHSA-pjfr-qf3p-3q25 Aliases: CVE-2017-12615	When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the …	7.0.79 Vulnerable 7.0.79 Vulnerable
GHSA-5q99-f34m-67gc Aliases: CVE-2018-11784	Apache Tomcat Open Redirect vulnerability When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and …	7.0.91 Vulnerable 7.0.91 Vulnerable
GHSA-8vmx-qmch-mpqg Aliases: CVE-2019-0232	Apache Tomcat OS Command Injection vulnerability When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 …	7.0.94 Vulnerable 7.0.94 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	7.0.94 Vulnerable 7.0.94 Vulnerable 7.0.94 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	There are no reported fixed by versions.
GHSA-m59c-jpc8-m2x4 Aliases: CVE-2018-1336	In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder An improper handing of overflow in …	9.0.8 Vulnerable
GHSA-jx6h-3fjx-cgv5 Aliases: CVE-2018-1305	Apache Tomcat information exposure vulnerability Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to …	9.0.5 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 7.0.85 Vulnerable
GHSA-46j3-r4pj-4835 Aliases: CVE-2018-8034	The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was …	9.0.10 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 7.0.90 Vulnerable 7.0.90 Vulnerable
GHSA-6rxj-58jh-436r Aliases: CVE-2018-1304	Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root …	9.0.5 Vulnerable 7.0.86 Vulnerable 9.0.5 Vulnerable 7.0.86 Vulnerable 7.0.86 Vulnerable
GHSA-r4x2-3cq5-hqvp Aliases: CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins The …	7.0.88 Vulnerable 7.0.88 Vulnerable 7.0.88 Vulnerable
GHSA-2rvv-w9r2-rg7m Aliases: CVE-2021-24122	Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions …	10.0.0-M10 Vulnerable 7.0.107 Vulnerable 7.0.107 Vulnerable
GHSA-jgwr-3qm3-26f3 Aliases: CVE-2021-25329	Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …	7.0.108 Vulnerable 7.0.108 Vulnerable
GHSA-3vx3-xf6q-r5xp Aliases: CVE-2017-5648	Exposure of Resource to Wrong Sphere in Apache Tomcat While investigating bug 60718, it was noticed that some calls to …	9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 7.0.76 Vulnerable 9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 7.0.76 Vulnerable 7.0.76 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 7.0.82 Vulnerable 9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 7.0.82 Vulnerable 9.0.1 Vulnerable 7.0.82 Vulnerable
GHSA-hh3j-x4mc-g48r Aliases: CVE-2019-12418	Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured …	7.0.99 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 7.0.104 Vulnerable 10.0.0-M5 Vulnerable 7.0.104 Vulnerable 7.0.104 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable 11.0.25 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2011-1088	Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via …
CVE-2019-17569	The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The …
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
CVE-2011-1582	Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured …